storj.io/minio@v0.0.0-20230509071714-0cbc90f649b1/docs/multi-user/admin/README.md (about)

     1  # MinIO Admin Multi-user Quickstart Guide [![Slack](https://slack.min.io/slack?type=svg)](https://slack.min.io)
     2  MinIO supports multiple admin users in addition to default operator credential created during server startup. New admins can be added after server starts up, and server can be configured to deny or allow access to different admin operations for these users. This document explains how to add/remove admin users and modify their access rights.
     3  
     4  ## Get started
     5  In this document we will explain in detail on how to configure admin users.
     6  
     7  ### 1. Prerequisites
     8  - Install mc - [MinIO Client Quickstart Guide](https://docs.min.io/docs/minio-client-quickstart-guide.html)
     9  - Install MinIO - [MinIO Quickstart Guide](https://docs.min.io/docs/minio-quickstart-guide)
    10  
    11  ### 2. Create a new admin user with CreateUser, DeleteUser and ConfigUpdate permissions
    12  Use [`mc admin policy`](https://docs.min.io/docs/minio-admin-complete-guide.html#policies) to create custom admin policies.
    13  
    14  Create new canned policy file `adminManageUser.json`. This policy enables admin user to
    15  manage other users.
    16  ```json
    17  cat > adminManageUser.json << EOF
    18  {
    19    "Version": "2012-10-17",
    20    "Statement": [
    21      {
    22        "Action": [
    23          "admin:CreateUser",
    24          "admin:DeleteUser",
    25          "admin:ConfigUpdate"
    26        ],
    27        "Effect": "Allow",
    28        "Sid": ""
    29      },
    30      {
    31        "Action": [
    32          "s3:*"
    33        ],
    34        "Effect": "Allow",
    35        "Resource": [
    36          "arn:aws:s3:::*"
    37        ],
    38        "Sid": ""
    39      }
    40    ]
    41  }
    42  EOF
    43  ```
    44  
    45  Create new canned policy by name `userManager` using `userManager.json` policy file.
    46  ```
    47  mc admin policy add myminio userManager adminManageUser.json
    48  ```
    49  
    50  Create a new admin user `admin1` on MinIO use `mc admin user`.
    51  ```
    52  mc admin user add myminio admin1 admin123
    53  ```
    54  
    55  Once the user is successfully created you can now apply the `userManage` policy for this user.
    56  
    57  ```
    58  mc admin policy set myminio userManager user=admin1
    59  ```
    60  
    61  This admin user will then be allowed to perform create/delete user operations via `mc admin user`
    62  
    63  ### 3. Configure `mc` and create another user user1 with attached policy user1policy
    64  ```
    65  mc alias set myminio-admin1 http://localhost:9000 admin1 admin123 --api s3v4
    66  
    67  mc admin user add myminio-admin1 user1 user123
    68  mc admin policy add myminio-admin1 user1policy ~/user1policy.json
    69  mc admin policy set myminio-admin1 user1policy user=user1
    70  ```
    71  
    72  ### 4. List of permissions defined for admin operations
    73  #### Config management permissions
    74  - admin:ConfigUpdate
    75  
    76  #### User management permissions
    77  - admin:CreateUser
    78  - admin:DeleteUser
    79  - admin:ListUsers
    80  - admin:EnableUser
    81  - admin:DisableUser
    82  - admin:GetUser
    83  
    84  #### Service management permissions
    85  - admin:ServerInfo
    86  - admin:ServerUpdate
    87  - admin:StorageInfo
    88  - admin:DataUsageInfo
    89  - admin:TopLocks
    90  - admin:OBDInfo
    91  - admin:Profiling,
    92  - admin:ServerTrace
    93  - admin:ConsoleLog
    94  - admin:KMSKeyStatus
    95  
    96  #### User/Group management permissions
    97  - admin:AddUserToGroup
    98  - admin:RemoveUserFromGroup
    99  - admin:GetGroup
   100  - admin:ListGroups
   101  - admin:EnableGroup
   102  - admin:DisableGroup
   103  
   104  #### Policy management permissions
   105  - admin:CreatePolicy
   106  - admin:DeletePolicy
   107  - admin:GetPolicy
   108  - admin:AttachUserOrGroupPolicy
   109  - admin:ListUserPolicies
   110  
   111  #### Give full admin permissions
   112  - admin:*
   113  
   114  ### 5. Using an external IDP for admin users
   115  Admin users can also be externally managed by an IDP by configuring admin policy with
   116  special permissions listed above. Follow [MinIO STS Quickstart Guide](https://docs.min.io/docs/minio-sts-quickstart-guide) to manage users with an IDP.
   117  
   118  ## Explore Further
   119  - [MinIO Client Complete Guide](https://docs.min.io/docs/minio-client-complete-guide)
   120  - [MinIO STS Quickstart Guide](https://docs.min.io/docs/minio-sts-quickstart-guide)
   121  - [MinIO Admin Complete Guide](https://docs.min.io/docs/minio-admin-complete-guide.html)
   122  - [The MinIO documentation website](https://docs.min.io)